0

Is it ok to store private keys in cloud provider (such as AWS, Firebase) secrets (enviroment variables) in cloud functions (such as lambdas or firebase cloud functions)?

I understand I would be trusting the safety of the funds in that address to the cloud provider, but I can't see another solution since I am building an application that has to sign bitcoin transactions from that address.

2

If the private keys are visible to you on your AWS account, then they'd be visible to anyone who has your session tokens (i.e. if a hacker would simply need to take your cookies to view the keys). So it's not only the cloud provider you'd need to worry about.

Always best to sign transactions on your own node which has no connection to your online accounts. You can build the transaction on your app, and send it off to be signed on your own server.

BitGo has some cool functionality that allows admin-approved transactions and multisig.

2

Is it ok to store private keys in cloud provider (such as AWS, Firebase) secrets (enviroment variables) in cloud functions (such as lambdas or firebase cloud functions)?

That's up to you. If you trust them sufficiently to effectively have the ability to steal your coins, or trust you could successfully get compensation from them in case that happens, this is a possibility.

but I can't see another solution since I am building an application that has to sign bitcoin transactions from that address.

The more reasonable solution would be to not run the logic that signs transactions on a cloud provider, but on your own hardware.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.